From b8e25b913f8b4563382cb46ead329b9b74d07e58 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Fri, 4 Sep 2026 07:12:27 +0100
Subject: [PATCH] fix(ci): ignore comments after workflow with keys

---
 scripts/ci/release-cache-contract.test.mjs | 35 +++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/release-cache-contract.test.mjs b/scripts/ci/release-cache-contract.test.mjs
index 4bac2f5c2..22377b51c 100644
--- a/scripts/ci/release-cache-contract.test.mjs
+++ b/scripts/ci/release-cache-contract.test.mjs
@@ -201,7 +201,7 @@ function readSiblingWithInputs(lines, usesIndex, propertyIndent, location, viola
     if (!line.structural || line.raw.trim() === '' || line.raw.trim().startsWith('#')) continue
     if (line.indent < propertyIndent) break
     if (line.indent === propertyIndent) {
-      const withMatch = /^\s*(?:with|"with"|'with')\s*:\s*(.*?)\s*$/.exec(line.raw)
+      const withMatch = /^\s*(?:with|"with"|'with')\s*:\s*(.*?)\s*$/.exec(stripYamlComment(line.raw))
       if (withMatch) {
         if (cleanScalar(withMatch[1]) !== '') {
           violations.add(`${location}: with must use a block mapping, not an inline scalar or flow mapping`)
@@ -1082,6 +1082,39 @@ test('tagged with input values cannot satisfy the cache-dependency-path contract
   )
 })
 
+test('trailing comments on with keys do not become inline inputs', () => {
+  const commentSources = validSyntheticClosure()
+  commentSources.set(
+    `${workflowPrefix}reusable-release-build.yml`,
+    commentSources.get(`${workflowPrefix}reusable-release-build.yml`).replace(
+      `      - uses: actions/setup-node@v7
+        with:
+          cache: npm`,
+      `      - uses: actions/setup-node@v7
+        with: # inputs below
+          cache: npm`,
+    ),
+  )
+  assert.doesNotThrow(() => enforceReleaseCacheContract(commentSources))
+
+  const inlineSources = validSyntheticClosure()
+  inlineSources.set(
+    `${workflowPrefix}reusable-release-build.yml`,
+    inlineSources.get(`${workflowPrefix}reusable-release-build.yml`).replace(
+      `      - uses: actions/setup-node@v7
+        with:
+          cache: npm`,
+      `      - uses: actions/setup-node@v7
+        with: inline
+          cache: npm`,
+    ),
+  )
+  assert.throws(
+    () => enforceReleaseCacheContract(inlineSources),
+    /with must use a block mapping, not an inline scalar or flow mapping/,
+  )
+})
+
 test('block scalars with indentation indicators are parsed before the cache-dependency-path check', () => {
   for (const header of ['|2', '|2-', '|-2', '>1+']) {
     const sources = validSyntheticClosure()